Unable to see the BitLocker Recovery Key

Chetan Sharma 116

Hi There,

I am seeing some weird issue where some IT personals are unable to retrieve the BitLocker Recovery Key for every other device. Sometimes it works and sometimes it does not. For the ones not working, while trying they see an error message about their permissions. (Snapshot attached)

User's image

Not sure what to check as this is happening randomly and not with every device.

Appreciate any help !

Thanks

Chetan S.

Catherine Kyalo 670 Reputation points Microsoft Employee

2024-03-21T13:39:32.2466667+00:00

IT admins need to have a specific permission within Microsoft Entra ID to be able to see device BitLocker recovery keys: microsoft.directory/bitlockerKeys/key/read. You can create/add a custom role with only this permission and assign to ensure Least Privilege

There are some other roles within Microsoft Entra ID that come with this permission, including Cloud Device Administrator, Helpdesk Administrator, etc. For more information on which Microsoft Entra roles have which permissions, see Microsoft Entra built-in roles.
Marius R 20 Reputation points

2025-01-24T09:02:36.2633333+00:00

This answer does not really address the question. The IT employee Chetan is referring to has the ability to see the recovery key of some devices but not of others, so I think it's safe to assume they are assigned the correct permissions.

The question then becomes why is the behavior inconsistent between devices?

I came across this thread because I am experiencing the same issue. We have a custom role created with the microsoft.directory/bitlockerKeys/key/read permission assigned to the role. When the role is not activated, the IT employee is not even able to see the bitlocker key ID of any device. When the role is then activated, they can see the bitlocker key IDs of all devices, but when checking the recovery key they only see it most of the time but not all of the time. We checked between two devices of which the owners have identical permissions and of one the recovery key could be observed and for the other we saw the exact message screenshotted here.
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Mitch S 0 Reputation points

2025-01-24T19:39:40.2833333+00:00

@Marius R , my organization is encountering the same issue. It was reported yesterday, but I'm unable to determine exactly when it began. Seeing your message today makes me think this could be more widespread, so I wanted to share this with you.

Share via

Unable to see the BitLocker Recovery Key

Your answer